Industry Vocabulary Reference

Professional Services & Management Consulting

Comprehensive enumeration library for the Professional Services & Management Consulting vertical. Covers every subdomain where agentic AI is actively deployed in professional services firms as of March 2026: audit and assurance documentation (GAAS / PCAOB / AICPA / ISA), engagement lifecycle management (scoping, staffing, quality control, independence verification), enterprise and cyber risk assessment (COSO ERM / ISO 31000 / FAIR), regulatory advisory (EU AI Act, SOC 2, ISO 27001, NIS2 / DORA), management consulting (process redesign, M&A advisory, IT advisory), and tax compliance and advisory. Designed for use as OTel span attributes in an agentic AI SDK and as policy vocabulary in an OPA Rego GRC portal, with specific coverage of the three canonical AI applications deployed in professional services governance programmes: Audit Workpaper Assistant, Engagement Scoping Bot, and Risk Assessment Coordinator.

Back to industry coverage library

This page shows selected examples and categories. Download the JSON for the complete vocabulary, including every field, permitted value, and policy pattern in this catalog.

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Choose an industry file for its workflow fields and permitted values.
3. Match the OTel attributes to the policy paths your rules use, then verify the recorded fields in a test session.

Catalog context

As of March 2026, agentic AI in professional services is deployed across: AI-assisted audit workpaper generation for GAAS/PCAOB engagements (revenue recognition, lease accounting, goodwill impairment, ICFR testing), engagement lifecycle management (scope definition, staffing, fee estimation, independence checking, proposal generation), enterprise and cyber risk assessment and board reporting (COSO ERM, FAIR model quantification, regulatory change impact), tax provision and uncertain tax position analysis (ASC 740, IRS Circular 230), M&A due diligence and quality of earnings (QoE) analysis, IT advisory and ERP migration scoping, ESG assurance and sustainability reporting (ISAE 3000, CSRD), and regulatory advisory under the EU AI Act and NIS2. The EU AI Act is a significant revenue opportunity for professional services firms that advise high-risk AI providers on Article 9 risk management systems, Article 17 quality management systems, and Article 43 conformity assessment. AI governance consulting is the fastest-growing advisory segment in the professional services market as of early 2026.

Risk note: PCAOB AS 2201 (ICFR audit) requires auditors to evaluate the design and operating effectiveness of controls over financial reporting, which now includes AI systems generating journal entries, valuations, or financial estimates. PCAOB Staff Spotlight: Use of Emerging Technology by Audit Firms (2023) specifically addresses the use of AI in audit, firms must document AI-assisted procedures and maintain appropriate quality controls. AU-C 240 fraud risk procedures apply when AI analytics flag anomalous journal entries; the auditor cannot delegate the fraud risk assessment conclusion to the AI system. SOC 2 Type II examinations of AI-assisted service organisations must specifically address the AI system's change management, access controls, and output integrity as part of the Trust Services Criteria. EU AI Act Annex III high-risk categories may capture AI used in professional services if the system influences access to essential services or makes decisions with legal or similarly significant effects on natural persons, advisory opinions that are delivered to clients through AI merit legal review against Article 6 and Annex III criteria.

Vocabulary file

• Download filename: 13_vertical_professional_services_consulting.json
• Kind: vertical

OTel namespaces

Referenced standards

These references explain the catalog's context. A listed standard does not establish that a configured application meets its requirements.

• AICPA AU-C Sections, Generally Accepted Auditing Standards (GAAS) for non-issuers (US)
• PCAOB Auditing Standards (AS), Auditing standards for SEC registrants and PCAOB-registered firms
• IAASB ISA (International Standards on Auditing), Global audit standards for non-US jurisdictions
• AICPA Code of Professional Conduct, Ethics and independence standards
• FASB Accounting Standards Codification (ASC), US GAAP authority
• ASC 606, Revenue from Contracts with Customers (IFRS 15 equivalent)
• ASC 842, Leases (IFRS 16 equivalent)
• ASC 350-40 / 350-20, Goodwill and Intangible Assets (impairment testing)
• ASC 330, Inventory (lower of cost or net realisable value)
• ASC 820, Fair Value Measurement
• ASC 740, Income Taxes (tax provision, uncertain tax positions)
• ASC 810, Consolidation (related-party and VIE considerations)
• PCAOB AS 2101, Audit Planning
• PCAOB AS 2110, Identifying and Assessing Risks of Material Misstatement
• PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting (ICFR / SOX 404b)
• PCAOB AS 2310, The Confirmation Process
• PCAOB AS 2401 / AU-C 240, Consideration of Fraud in a Financial Statement Audit
• PCAOB AS 2501, Auditing Accounting Estimates
• PCAOB AS 2541, Auditing Inventories
• PCAOB AS 2601, Consideration of an Entity's Use of a Service Organization
• PCAOB AS 2810, Evaluating Audit Results
• PCAOB AS 3101, The Auditor's Report on an Audit of Financial Statements
• AICPA SSAE 18 / AT-C 205, Attestation Standards; SOC 2 examination framework
• ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Financial Information
• ISAE 3402, Assurance Reports on Controls at a Service Organisation (equivalent to SSAE 18 SOC 1)
• COSO Internal Control, Integrated Framework (2013), Internal controls assessment reference
• COSO ERM 2017, Enterprise Risk Management, Integrating with Strategy and Performance
• ISO 31000:2018, Risk Management Guidelines
• ISO 31010:2019, Risk Assessment Techniques
• FAIR (Factor Analysis of Information Risk), Cyber risk quantification model
• AICPA / CIMA, Chartered Global Management Accountant (CGMA) competency framework for advisory
• IRS Circular 230, Regulations Governing Practice Before the IRS (tax advisory)
• OECD Model Tax Convention, Transfer pricing and international tax advisory
• EU AI Act (2024/1689), AI used in audit opinion generation, regulatory filings, and advisory
• SOC 2 Type II (AICPA TSC 2017), Trust Services Criteria for AI-assisted service organisations
• ISO/IEC 27001:2022, Information Security Management System
• NIS2 Directive (EU) 2022/2555, Network and Information Systems security for PS firms
• DORA (EU) 2022/2554, Digital Operational Resilience Act (applicable to PS firms servicing financial entities)
• GDPR (EU) 2016/679, Client data handling and AI-assisted processing in advisory workflows
• PCAOB Cybersecurity Risk and Internal Controls, Emerging guidance on audit of AI systems

Source references

• https://pcaobus.org/Standards/Auditing 
• https://www.aicpa-cima.com/resources/landing/professional-standards 
• https://fasb.org/standards 
• https://www.ifac.org/knowledge-gateway/audit-assurance/publications/2009/03/clarified-international-standards-auditing 
• https://www.pcicomplianceguide.org/ 
• https://www.riskmanagementinsight.com/media/docs/FAIR_introduction.pdf 
• https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689 

Subdomains

Implementation examples

• Audit & Assurance Workpaper Management: Workpaper Type. Audit Workpaper Assistant tags each session with the workpaper type. OPA policy enforces that fraud_risk_assessment and icfr_deficiency_evaluation workpapers may not be filed without a partner-level sign-off HITL step. Revenue recognition and going_concern_assessment workpapers for SEC registrants require an additional QC review gate per PCAOB AS 2810. (Pcaob As 2101: PCAOB AS 2101, Audit planning must identify key risk areas that must be addressed in the workpaper file)
• Audit & Assurance Workpaper Management: Audit Phase. Audit Workpaper Assistant tags each session with the current audit phase. Policy rules gate certain AI actions by phase, for example, AI may not generate a final opinion draft during the fieldwork phase, and may not add new significant risk factors to the register during the completion phase without escalation. (Pcaob As 2101: PCAOB AS 2101, Audit planning phase must be completed and approved by the engagement partner before fieldwork commences)
• Audit & Assurance Workpaper Management: Audit Staff Level. AI policy evaluation sign-off authority. Sessions initiated by a staff_associate or senior_associate flag any AI-generated significant estimate conclusion as 'pending manager review'. Fraud risk conclusions and going-concern adverse assessments require engagement_partner or concurring_reviewer sign-off before filing. (Pcaob As 2101: PCAOB AS 2101, Engagement partner must plan the nature, timing, and extent of supervision before fieldwork begins)
• Audit & Assurance Workpaper Management: Workpaper Qc Gate. Audit Workpaper Assistant transitions the workpaper through QC gates automatically, emitting an OTel span at each state transition. OPA policy blocks the filed_to_engagement_file state unless partner_signoff_complete is recorded for significant judgment areas. The QC gate state is used in compliance posture dashboards to show what percentage of AI-assisted workpapers have completed the full QC chain. (Pcaob As 2810: PCAOB AS 2810, Evaluating Audit Results requires engagement partner assessment; AI conclusions require partner_review_required gate before filing)

Enforce before the action

Pass the request and your business action to this function. The core SDK checks policy before the action runs and again before its result is released. A deny or review decision means the action never runs.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "ps.workpaper.type", policyInput: "ps_workpaper_type", value: "asc606_revenue_recognition" },
    { attribute: "ps.audit.phase", policyInput: "ps_audit_phase", value: "client_acceptance" },
    { attribute: "ps.audit.staff_level", policyInput: "ps_audit_staff_level", value: "staff_associate" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "professional.services.consulting.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

• Replace the sample values with facts from the current workflow. Rules read them under input.snapshot.industry.
• Test both permitted and blocked actions. Confirm that a blocked action never reaches your business function.
• Only completed, completed_with_warning, and transformed results carry a released value.

For review decisions, follow the Human Review guide to configure continuation. Observe remains available when you need to record activity without enforcing a decision.

Set up the Professional Services & Management Consulting example. See the API reference for TypeScript, Python, or .NET.

Selected vocabulary categories

This page uses the vocabulary JSON distributed with the documentation. Check its version when comparing it with an installed SDK.

Download the vocabulary JSON for offline review or automated comparisons.

Use the SDK reference for configuration and supported APIs. Keep vocabulary selection separate from the compliance team's assessment of applicable requirements.